The Camel-Knative component incorrectly maps CloudEvent extension fields to internal Camel message headers when the event is sent in structured mode. This issue arises from improper input validation (CWE-20) and improper neutralization of special elements in output used by a downstream component (CWE-74). An attacker can supply arbitrary keys in the JSON body, causing headers such as CamelHttpUri or CamelFileName to be overwritten. These injected headers are then used by downstream components that drive the HTTP or file systems, permitting the attacker to redirect requests, read arbitrary files, or send requests to internal network resources.

Affected are all Apache Camel releases from 3.15.0 up to 4.14.8, from 4.15.0 to 4.18.3, and from 4.19.0 to 4.20.9. The LTS tracks include 4.18.x and 4.14.x. Any deployment that exposes a Knative consumer endpoint can be impacted. The issue does not affect earlier 3.x releases before 3.15.0 or Camel 4.21.0 and later.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score (< 1%) shows a very low probability of exploitation, but the vulnerability can be leveraged without authentication to perform SSRF, path traversal, or message‑dispatch redirection. The issue is not listed in the CISA KEV catalog. Due to the potential impact on confidentiality, integrity, and availability, the vulnerability should be addressed with priority.